<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Sorry, I should have said the sites were <br><br><a href="http://abc.com">abc.com</a><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">
<a href="http://xyz.com">xyz.com</a><br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">The sites are completely independent. I understand that the sub-domain approach is not recommended.<br>
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Given that what configuration changes need to be made.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">
Thanks,<br>-Senthil<br></div><div class="gmail_extra"><br clear="all">
<br><br><div class="gmail_quote">On Wed, Jan 15, 2014 at 5:34 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 1/15/14, 5:30 PM, "Senthil Ramiah" <<a href="mailto:sramiah@aileronconsulting.com">sramiah@aileronconsulting.com</a>><br>
wrote:<br>
><br>
>Question: The shibboleth2.xml file has the HOST entries for these two<br>
>sites. We would like two different Identity Providers for these sites,<br>
>i.e. IdP1 for <a href="http://abc.xyz.com" target="_blank">abc.xyz.com</a> and IdP2 for <a href="http://def.xyz.com" target="_blank">def.xyz.com</a>. We have the Metadata<br>
>files for them. Can someone point me to some documentation of how this<br>
>can be configured so that requests to <a href="http://abc.xyz.com" target="_blank">abc.xyz.com</a> is authenticated by<br>
>IdP1 and requests to <a href="http://def.xyz.com" target="_blank">def.xyz.com</a> can be authenticated by IdP2.<br>
<br>
I don't advocate the approach because it's impossible to federate such an<br>
application later and support both IdPs at once, but locking a host to an<br>
IdP is done by adding the entityID property to the <Host> element in the<br>
<RequestMap>.<br>
<br>
You still need proper authorization of users based on attributes. Do not<br>
expect the SP to limit access based on IdP, that's not the proper design.<br>
Acceptance of assertions is about trust, authorization is about the user<br>
and attributes.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div></div>